summaryrefslogtreecommitdiff
path: root/flowtop.c
AgeCommit message (Collapse)AuthorFilesLines
2015-10-23flowtop: Show flow rate of bytes & packetsVadim Kochan1-6/+75
Calculate and display the rate of src/dst bytes and packets. Also change the refresh time for the flows to 1s so the rate info will not disappear too quickly. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-09-07flowtop: Don't attempt to set sysctl values if initial read failsTobias Klauser1-0/+2
Bail out early if we fail to read the current sysctl variable values for net/netfilter/nf_conntrack_acct and net/netfilter/nf_conntrack_timestamp Otherwise we'll not be able restore the previous value on exit/panic. Moreover, if we fail to read the sysctl file, we usually also lack the permissions to write it. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-09-03flowtop: Enable flow timestamp on startVadim Kochan1-9/+36
Allow setting start/stop timestamp for new flows by enabling: /proc/sys/net/netfilter/nf_conntrack_timestamp on start and resetting it on exit or panic. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [tklauser: Remove unnecessary cast of void pointer] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-09-03flowtop: Show flow time durationTobias Klauser1-0/+33
Show flow time duration in human readable form. Originally submitted by Vadim in a slightly different form. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-07flowtop: Simplify nfct_is_dns()Tobias Klauser1-13/+8
Instead of creating an additional struct flow_entry on the stack just to use the CP_NFCT macros, call nfct_get_attr_u16() directly. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-06flowtop: Show counters in same color as their directionVadim Kochan1-20/+22
Show byte/packet counters in the same colors as their direction: - src in red - dst in blue so it will be easiser to identify them by direction. Also unifed counters printing in one function and changed counters naming similar to other *_src members of flow_entry struct. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [tklauser: Reverted to using parentheses in printed message] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-04flowtop: Do not insert DNS flows into listVadim Kochan1-9/+20
Just ignore DNS flows instead of insert it and then filter it out by presenter. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-04flowtop: Resolve src host if '-s' option specifiedVadim Kochan1-2/+4
Do not do reverse DNS for src hostname if '-s' option is not specified. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-04flowtop: Don't hide status bar while dumping flowsVadim Kochan1-15/+12
Don't hide status bar line when dumping flows but print "[Collecting flows ...]" on the same line. Really there is no sense to hide this status bar line. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-03flowtop: Show counters by directionVadim Kochan1-15/+25
Show bytes/pkts counters per src/dst direction. By default counters originated from dst are showed. Src counters are showed only if '-s' is specified. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-03flowtop: Get rid of flushing flows by dumping ipv4/ipv6 tablesVadim Kochan1-30/+122
Get rid of flushing connections which resets all counters. Use dump whole ipv4/ipv6 connection tables to fullfill the existing flows, but this needs to use hand-made flow filtering because nfct_filter does not work when we do NFCT_Q_DUMP. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-03flowtop: Rename collector_cb -> flow_event_cbVadim Kochan1-3/+3
Rename collector_cb to reflect behaviour such as catching flow events. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-03flowtop: Rename ct_dump -> ct_update, dump_cb -> flow_update_cbVadim Kochan1-8/+8
Rename ct_dump variable & update_cb function so they reflect 'updating' of a particular flow at runtime. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-08-03flowtop: Move filter creating to separate functionVadim Kochan1-16/+18
Move creating nfct filter to separate function to make collector() less messy. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-27flowtop: Fix missing new connections after flushVadim Kochan1-2/+2
There might be new fast connection between flush & handling new events which can be not handled, so put flushing connections before loop. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-27flowtop: Make struct flow_entry member size checks build_bug_on()Tobias Klauser1-3/+3
The city_{src,dst}, country_{src,dst} and rev_dns_{src,dst} members of struct flow_entry have their size defined at compile time, so perform the equal size checks at compile time as well. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-26flowtop: Fix collector stuck while flush IPv6 flowsVadim Kochan1-5/+17
Seems it was caused by specifying all netfilter groups when flushing connections. Used separated nfct instance w/o netfilter groups to flush ipv4/ipv6 connections. More info can be fetched from the issue item on github: https://github.com/netsniff-ng/netsniff-ng/issues/145 Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-26flowtop: Fix bytes counter print for gigabyteVadim Kochan1-1/+1
'G' should be printed when bytes > 1000000000 but it was printed with 'M' prefix which was caused by missing 'else'. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-26flowtop: Use prev & next vars in flow_list_find_prev_id(...)Vadim Kochan1-6/+6
Replace n & tmp variables to more understandable prev & next. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-26flowtop: Change tcp param to 'bool is_tcp' in presenter_get_port(..)Vadim Kochan1-5/+5
Rename tcp -> is_tcp param and change it to bool. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-26flowtop: Use bool as parameter in get_port_inode(..)Vadim Kochan1-1/+1
Convert int -> bool as parameter. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-26flowtop: Convert bool in flow_entry_get_extended_is_dns(...)Vadim Kochan1-1/+1
Use bool as return type in flow_entry_get_extended_is_dns(...) func. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-23flowtop: Make presenter_flow_wrong_state() return boolTobias Klauser1-8/+6
Only 0/1 are used as return values, change to type bool. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-22flowtop: Replace bool lookup tables by switch statementTobias Klauser1-40/+37
Use a switch statement instead of looking up a valid state in the *_states_show bool arrays in presenter_flow_wrong_state(). This makes the code a bit easier to read. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-21flowtop: Simplify assignment of flow_entry->is_visibleTobias Klauser1-9/+7
Just assign a default value of false and override it with true if the checks go through. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-20sysctl: Add sysctl module with /proc/sys helpersVadim Kochan1-54/+1
Moved sysctl get/set funcs from flowtop to separated sysctl module. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-20Revert "flowtop: Don't init screen until collector is ready"Vadim Kochan1-9/+0
Follow-up of commit 9a89c1d813fb ("Revert "flowtop: Fix hanging while waiting for collector"") which both address the clean up in the panic handler. This reverts commit 451275470106024f106a310a5af050b3ca046a4f. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-07-17flowtop: Indentation fixes for multiline function signaturesTobias Klauser1-3/+3
Align the arguments/parameters on successive lines with the opening parenthesis. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-17flowtop, netsniff-ng: Move process name extraction to own functionTobias Klauser1-8/+4
flowtop and the netsniff-ng's netlink message dissector both need to get the process name for a pid from /proc/<pid>/exe, thus move that functionality to an own function. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-17flowtop: Use strncpy instead of strcatTobias Klauser1-4/+2
Make the path creation a bit more straight-forward. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-17flowtop: Show flow bytes in human readable formatVadim Kochan1-3/+21
Print flow bytes amount in human readable format units (G,M,K). Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [tklauser: Make bandw2str static, change arg type, formatting] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-17flowtop: Show total numbers of flowsVadim Kochan1-14/+19
Count flows which might be showed and show this number on the top status line. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-17flowtop: Add connection traffic accountingVadim Kochan1-26/+202
Mark each flow if it is visible on the screen to know if it is needed update traffic acct info. Changed to use non blocking recv of nf conntrack events to update traffic accounting. Now nf_conntrack is cloned when new flow entry is added to send dump request which is used to update traffic accounting info (packet, bytes). Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [tklauser: Formatting changes] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-17flowtop: Refactor walking for each flow node by presenterVadim Kochan1-79/+52
Change code to walk each flow by presenter to look more understandable. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> [tklauser: Revert unnecessary whitespace changes] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-07-13flowtop: Fix flows disappearingVadim Kochan1-1/+3
While removing flow which is pointed by 'head' then head is set to NULL and all the list disappears, so fixed by set removing flow next entry to list 'head'. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2015-03-23flowtop: Print error cause if errno is set when panicVadim Kochan1-5/+5
Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2015-03-20flowtop: Don't init screen until collector is readyVadim Kochan1-0/+9
In case if main thread already initialized screen but then collector called panic, the process exits but console stays with the same colored screen and shifted shell prompt. Fixed by adding conditional variable locking. Signed-off-by: Vadim Kochan <vadim4j@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-12-12all: Reduce amount of empty liens in usage and version output a bitTobias Klauser1-5/+5
No need for some of the empty lines, remove them to make the output a bit denser. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-09-08flowtop: Use integer conversion to determine PID proc entriesTobias Klauser1-13/+20
Try to convert the directory entry name to an unsigned integer with strtoul() instead of using strspn() to determine if a proc entry is a PID. If it is a valid PID (i.e. strtoul returned a value != 0), we can directly use it to pass into walk_process() and there set flow_entry->proc_num. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-09-08flowtop: Simplify entry skip logicTobias Klauser1-10/+5
Instead of testing three skip conditions for every entry, make use of the short-circuit evaluation of the boolean OR operator to only test as few conditions as necessary. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-09-05flowtop: Don't duplicate copyright/bug report/license stringTobias Klauser1-16/+12
Move the copyright/bug report/license string to an own constant and use it for the output of help() and version() to avoid duplication and prevent the strings from getting out of sync. This makes the text section of flowtop.o slightly smaller: before: text data bss dec hex filename 15601 4 48 15653 3d25 flowtop/flowtop.o after: text data bss dec hex filename 15228 4 48 15280 3bb0 flowtop/flowtop.o Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-07-23build: flowtop: Only build ioops with GeoIP support enabledTobias Klauser1-1/+0
Follow commit 9ad7f8882097 ("build: astraceroute: Only build ioops with GeoIP support enabled"). The ioops module is only needed in geoip.o, thus make it dependent on CONFIG_GEOIP. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-06-13lookup: Move UDP/TCP port and Ethernet type lookup into own moduleTobias Klauser1-3/+5
Up to now, the lookup of TCP/UDP port names and Ethernet types was tightly integrated with the dissector infrastructure, since it is its main user. However, flowtop also makes use of the name lookup functionality without needing the actual dissector infrastructure. Thus, the basic dissector infrastructure also needs to be linked into flowtop without actually being used. Fix this by extracting the port/ethertype lookup into an own module which can then be used either directly (for flowtop) or as part of the dissector infrastructure (for netsniff-ng). This also reverts the quick & dirty fix introduced in commit f3322c6 ("flowtop: Include netlink dissector to fix build temporarily"). Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-05-27geoip: Pass struct sockaddr_in{,6} as pointer instead of by valueTobias Klauser1-4/+4
Change the interface to the geoip_* functions to take a pointer to a struct sockaddr_in{,6} instead of the struct itself. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-05-27flowtop: Constify function parameter in walk_process()Tobias Klauser1-1/+1
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-05-03all: Use macros for printf/scanf format specifiersJames McCoy1-4/+5
Any types that are fixed width should use the standard format specifier macros (PRI... for printf-type functions, SCN... for scanf-type functions) to ensure proper data access. Prior to this ifpps was crashing in 32-bit environments due to the following call mvwprintw(screen, (*voff)++, 2, "%s,%s %s (%s%s), t=%lums, cpus=%u%s/%u" " ", uts.release, machine, ifname, drvinf.driver, buff, ms_interval, top_cpus, top_cpus > 0 && top_cpus < cpus ? "+1" : "", cpus); since ms_interval is a uint64_t but %lu expects an unsigned long, which is only 32 bits. Signed-off-by: James McCoy <vega.james@gmail.com> Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2014-02-22flowtop: Exit gracefully for all possible termination signalsTobias Klauser1-0/+4
Handle all termination signals that we're allowed to handle (SIGKILL can't be handled) in order to exit gracefully in any regular termination case. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2013-07-29flowtop: Fix compiler warningsTobias Klauser1-2/+3
Fix the following compiler warnings that occur when building with "-W -Wall -Wextra": flowtop.c: In function ‘walk_process’: flowtop.c:417:45: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] flowtop.c: In function ‘presenter_screen_update’: flowtop.c:937:16: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] flowtop.c:938:17: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2013-07-14flowtop: Mark unused parameters with __maybe_unusedTobias Klauser1-2/+2
In order to avoid compiler warnings when compiling with -W/-Wunused-parameter, mark unused function parameters with __maybe_unused. Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2013-07-13misc: fix multiple NULL pointer sparse warningsDaniel Borkmann1-1/+1
Those are fixes for the following warnings: pcap_mm.c:119:29: warning: Using plain integer as NULL pointer pcap_mm.c:141:29: warning: Using plain integer as NULL pointer ring.c:24:31: warning: Using plain integer as NULL pointer flowtop.c:1114:22: warning: Using plain integer as NULL pointer ifpps.c:1133:29: warning: Using plain integer as NULL pointer Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-03 16:53:37 +0000